Win 11 User Pin

Hey All,

We recently had an employee who left the company and he was the only user on the computer. I enabled the built in admin account and I was able to change the password and have gained access to the account. Problem is the PIN. When I go to change or disable the pin, the recovery email is the guy's personal email. It wasn't a good separation and that is why I'm in this mess. Is there any way around this? Is there anywhere in the registry that saves this email that I could change? Any suggestions would be appreciated.

Hello, and welcome.

Is there something you're trying to recover other than just resetting Windows to start fresh on the computer?

The box has a lot of software with individual license keys and a ton of info that I can't afford to lose. Thanks Brink.

While signed in to the built-in Administrator, you can try this below to see if it may help:

1) Use option 2 below to disable passwordless sign-in for Microsoft account. This will allow you to sign in with the password instead of PIN.


2) Use option 2 below to remove the PIN for all users on the PC.

Sorry to hear about the problem your having. Employees should never have admin rights on a company computer.

Winuser said:

Sorry to hear about the problem your having. Employees should never have admin rights on a company computer.

Click to expand...

Definitely not domain Admin but local Admin is rather common.

OAT said:

Definitely not domain Admin but local Admin is rather common.

Click to expand...

Doesn't that open the door to them being able to make changes that can cause problems like this or even worse. If I owned a company I wouldn't want my employees making changes to to OS.

Winuser said:

Doesn't that open the door to them being able to make changes that can cause problems like this or even worse. If I owned a company I wouldn't want my employees making changes to to OS.

Click to expand...

If your domain is set up correctly, damage is limited to the user's system in any case.
Besides you have remote Backup/Restore software. We use Veritas for that.
As far as the issue in this thread, we would simply swap the entire drive to a previous image.
But I digress, as usual.

OAT said:

Not if your domain is set up correctly.
Besides you have remote backup software..

Click to expand...

Sound like they don't have a backup. With a disgruntled employee having admin rights what's stopping them from infecting the computer with who knows what? I'm not trying to disagree with you. It's just that I see it a possibility of being disastrous to a company owned computer.

Winuser said:

Sound like they don't have a backup. With a disgruntled employee having admin rights what's stopping them from infecting the computer with who knows what? I'm not trying to disagree with you. It's just that I see it a possibility of being disastrous to a company owned computer.

Click to expand...

Then the virus would be limited to that system. It would not propagate.
When the employee leaves, the mailbox is disabled and his drive is archived and then wiped clean & re-used.
VPN and RDP are immediately disabled. It's all about the right architecture and the right processes in place.

OAT said:

Then the virus would be limited to that system. It would not propagate.
When the employee leaves, the mailbox is disabled and his drive is archived and then wiped clean.
VPN and RDP are disabled.

Click to expand...

I guess we're looking at this differently. From reading post #1, I see a company computer that an employee was able to lock them out of by changing the pin and having the recovery key sent to their personal email. I still fail to see the plus of allowing an employee to have admin rights on a company owned computer even if they can only cause trouble on just the one computer.

Winuser said:

I guess we're looking at this differently. From reading post #1, I see a company computer that an employee was able to lock them out of by changing the pin and having the recovery key sent to their personal email. I still fail to see the plus of allowing an employee to have admin rights on a company owned computer even if they can only cause trouble on just the one computer.

Click to expand...

If the company is a start-up - or small -and lacks an IT department and infrastructure from the get-go, problems like these will emerge.
If you don't have the right protocols in place, you always pay in the end. That is why IT consultants are needed early on.
Sadly, the budget is spent on hardware and software first.
The fact that the OP is trying to recover serial numbers for some applications proves that he/she is working in a challenging environment free of licensing structure and backup solution. This is a difficult state of affair.

OAT said:

The fact that the OP is trying to recover serial numbers for some applications proves that he/she is working in a challenging environment free of licensing structure and backup solution. This is a difficult state of affair.

Click to expand...

I guess I'm looking at this from a very small business point of view. I would want my company computers to be as safe as possible from any of my employees for as cheap and easy as possible. I'll never own my own business but if I did I would never allow my employees to be able to make any changes to my computers that I didn't authorize and that includes but not limited to changing passwords/pin numbers or installing software. From your post I'm thinking you know a lot about how medium to large companies handle the security of their company computers and I give you a big 2 thumbs up for having that knowledge. Something I'll never have.

Should’ve hidden the pages in settings via reg mods. I would def implement that from now on. Prevent them from adding a pin to begin with.
You should be able to use @Brink tutorial to remove the pin, and then it’ll prompt you to recreate one while logging into that user again

11users said:

The box has a lot of software with individual license keys and a ton of info that I can't afford to lose

Click to expand...

If you have a Current Backup of this computer, you can wipe the computer and you will not lose any info.
If you login now as Admin, Do a Backup. this would backup all the apps and files. Also if you run Belarc Advisor, it will tell you all the Product Keys of all the software. You can also copy and paste any files you want to keep to another drive. Once confirmed all the data is backed up successfully, wipe the computer and do a Clean Install of Windows 11 for the next employee.

11users said:

The box has a lot of software with individual license keys and a ton of info that I can't afford to lose

Click to expand...

So I am assuming no record was kept at the administrative level regarding license keys, any involved bitlocker key, and no master image was ever made of this computer before this employee ever got connected to it.

It seems you have regained access to the system so I am assuming you have access to the licensed appsusing the Admin account.. Correct? If not, it means those apps were installed for that employee user only. If you have access to the apps using the administrator account, I suggest you try to work with their developer to acquire the keys they were licensed with so the apps can be reinstalled for another user. If these apps were purchased/licensed under that employee's name rather than yours, this won't be posssible. As was suggested Belarc might help if the regular license keys are stored in the computer rather than generic ones.

From a standpoint of regaining access to the employee files, several scenarios come into play here.
Here's the way I see it. Everyone correct me if I am wrong.

Only if the files were saved by the employee locally, and the drive is not bitlocked, you can boot from any live Linux distro and copy the files to external media. Linux does not care about permissions.

However, Linux can't help get those files if the employee account was synced to onedrive using his MS account OR if bitlocker/device encryption was set up on that computer using that employees MS account . Linux cannot unlock bitlocked drives without some sort of a third-party BitLocker solution for Linux. Even then you must have access to the bitlocker key that would be stored in the employee's MS account. Bitlocker can not be bypassed without clean installing Windows.

The only way thing you can do if bitlocker/onedrive is in play here is hope the employee will give you the bitlocker key to unlock the drive and give you his pin so you can access his files.

This may be a case of "hard lesson learned" for you.